MALICIOUS — 24cc59ef380a321a45ddbb1f148a63a32269646bc16ff91349d13fa1a264077f
MALICIOUS — 24cc59ef380a321a45ddbb1f148a63a32269646bc16ff91349d13fa1a264077f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Maldoc family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.
Identification
- SHA-256:
24cc59ef380a321a45ddbb1f148a63a32269646bc16ff91349d13fa1a264077f - SHA-1:
d7f78c533d44a12d205f8bc0c748ddc4d9b5d383 - MD5:
f8f99c2d37034b9028bcbd82e690e390 - imphash:
3f92177474a00f02451a855b96e05f57 - ssdeep:
3072:3Hjk+0oLnWFnzBHv/xWFsg8WatFBGFVWPE5ac0pG/1z+QVMbg1:Xo/BHng5HaVG4G/1z+QVMbg1 - TLSH:
T189428D8F3A29EE42E2E7DA075D04FDBD208F5897263AF5682AD9951E44C327B043113D - Submitted as: 24cc59ef380a321a45ddbb1f148a63a32269646bc16ff91349d13fa1a264077f
- File type: pe · Size: 212992 bytes
- Verdict: malicious (100/100) · Family: Maldoc
Detections (7 of 56 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Worm.Vobfus-7513439-0
- YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Worm:Win32/Cambot.A
- Emsisoft (Emergency Kit): Trojan.GenericKD.50020741
- Kaspersky (KVRT): Trojan.Win32.Llac.llzl
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 20 weighted signals:
- ClamAV (daily) flagged Win.Worm.Vobfus-7513439-0 (rule
Win.Worm.Vobfus-7513439-0) - engine signal, weight 0.90, confidence 0.95 - 2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.63, confidence 0.90 - YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule
DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70 - Microsoft Defender flagged Worm:Win32/Cambot.A (rule
Worm:Win32/Cambot.A) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.50020741 (rule
Trojan.GenericKD.50020741) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Llac.llzl (rule
Trojan.Win32.Llac.llzl) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 4 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
- Extracted BlackshadesRAT config (0 C2) - engine signal, weight 0.45, confidence 0.60
- capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://www.facebook.com/?ref=home, http://www.facebook.com - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
6530 behavior events · 3 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- migsel.com
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- login.live.com
- update.googleapis.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\ag58fpqon.exe.jpg -
395e35729877e3122e60858ed7a0fb3703abc2166848e10145361a58dbdcd469
Embedded URLs
- http://www.facebook.com/?ref=home
- http://www.facebook.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://migsel.com/system/classes/alive.php?key=Blackshades%5FKey&pcuser=analyst&pcname=DESKTOP%2DHSGCBEP&hwid=800E9CC0&country=United+States
- http://migsel.com/system/classes/fg.php?key=Blackshades%5FKey
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- www.facebook.com
- bankofamerica.com
- migsel.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 52.168.112.67
- 48.211.4.16
- 20.247.184.197
- 4.230.171.124
- 20.165.94.63
- 135.232.92.97
- 20.50.201.203
- 40.84.97.4
- 20.42.65.94
- 104.18.33.89
- 95.128.128.129
- 52.110.12.20
- 52.110.12.33
- 104.208.16.94
- 52.168.117.168
- 92.223.78.30
- 125.56.205.26
- 125.56.205.42
- 125.56.205.17
- 72.145.35.105
- 52.148.114.188
- 52.110.12.46
- 52.110.12.47
Registry keys
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
File paths
- C:\Program
- C:\Windows\SysWOW64\ieframe.dll
More Maldoc samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report